Programs crashing, random BSODs, lots of instability

My brother's computer keeps getting BSODs, and he's having other issues where programs are randomly crashing as well. It can happen to any program, and Windows services are randomly crashing too according to Event Viewer. I've done the usual stuff: updated all drivers, ran Windows updates, ran sfc /scannow and the DISM equivalent, but nothing is fixing it. Logs are attached. He was having the problem on 1903, I updated him to 1909, still happening.

Hi Vaindil,

Welcome to the BSOD forum.

For all steps / tests please post images into the thread:


Take Screenshot in Windows 10
https://support.microsoft.com/en-gb/...re-screenshots
How to Upload and Post Screenshots and Files at Ten Forums

1) Open administrative command prompt and type or copy and paste:
2) sfc /scannow
3) dism /online /cleanup-image /scanhealth
4) dism /online /cleanup-image /restorehealth
5) sfc /scannow
6) chkdsk /scan
7) wmic recoveros set autoreboot = false
8) wmic recoveros set DebugInfoType = 7
9) wmic recoveros get autoreboot
10) wmic recoveros get DebugInfoType
11) bcdedit /enum {badmemory}

12) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

13) Make sure that there is no over clocking while troubleshooting

14) In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings

a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery window into the thread

b) > on the advanced tab under performance > click on settings > on the performance options window > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory window into the thread

15) Open Ccleaner > click windows tab or custom clean > scroll down to system and advanced > post an image into the thread

16) Post a share link using one drive, drop box, or google drive for:
C:\WINDOWS\LiveKernelReports\PoW32kWatchdog-20200422-2006.dmp

Code:

LastWriteTime         Size (MB) FullName                                                                    
-------------         --------- --------                                                                    
4/22/2020 8:06:53 PM     714.06 C:\WINDOWS\LiveKernelReports\PoW32kWatchdog-20200422-2006.dmp

17) Run Memtest86 version 8.4 (or newer version if available) for four passes.
Repeat the test so that eight passes are performed.

MemTest86 - Official Site of the x86 Memory Testing Tool

Use a camera or smart phone camera to take pictures and post images into the thread.
In case there are any problems uploading images use share links (one drive, drop box, or google drive)

Memtest86 has a feature to produce a text report.
Please post this in addition to the images.

18) Run HD Tune (free version) (all drives)
HD Tune website
Post images into the thread for results on these tabs:
a) Health
b) Benchmark
c) Full error scan

19) Run Sea Tools for Windows
long generic test
Post an image of the test result into the thread
SeaTools for Windows |
Seagate
How to use SeaTools for Windows | Seagate Support US


20) Make sure that the free space on C: drive remains > 30 GB during the troubleshooting


21) These tests can be performed overnight:
a) HD Tune full error scan
b) Sea Tools for Windows long generic test
c) Memtest86 version 8.4

Code:

Event[7616]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2020-05-13T21:05:34.635
  Event ID: 1018
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-4IU087C
  Description: 
The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.

Code:

5/1/2020 1:42 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 139
P2: 3
P3: ffffef8d3b1db7b0
P4: ffffef8d3b1db708
P5: 0
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\043020-21812-01.dmp
\\?\C:\WINDOWS\TEMP\WER-26625-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER79C5.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER79D6.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER79D5.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER79E6.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_139_86277d29d794c9b7ba243242757921794841d_00000000_cab_fafc0ff6-5e9c-4830-85d7-6c0cb69e7073

Analysis symbol: 
Rechecking for solution: 0
Report Id: e0f42115-fc5e-4897-9a75-b728493cbbcc
Report Status: 4
Hashed bucket: 
Cab Guid: 0
5/14/2020 12:05 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 18
P2: 0
P3: ffff9c8b0f836370
P4: 2
P5: fffffffffffffff8
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051320-27937-01.dmp
\\?\C:\WINDOWS\TEMP\WER-33031-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9356.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9386.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9395.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER93A5.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_18_318d4fb38a8c032f63199325b82f7373414ea84_00000000_cab_facb9f1a-433b-4cd3-a502-31a8e6c593c9

Analysis symbol: 
Rechecking for solution: 0
Report Id: b404c07d-f667-49c3-8449-7d773e9f9f00
Report Status: 4
Hashed bucket: 
Cab Guid: 0
5/12/2020 11:28 PM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 3b
P2: c000001d
P3: fffff807418ee200
P4: ffffc78349aedcb0
P5: 0
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051220-10093-01.dmp
\\?\C:\WINDOWS\TEMP\WER-21593-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BBA.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BCA.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BE9.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C47.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_3b_576bc767e51ebcf27ff947d9a2ef5e4cab153258_00000000_cab_5bb80dc1-e2ae-4cf4-b5ff-f70a05524264

Analysis symbol: 
Rechecking for solution: 0
Report Id: 7737b975-53b6-4282-af75-417d93ec713f
Report Status: 4
Hashed bucket: 
Cab Guid: 0
3/25/2020 7:54 PM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 50
P2: fffff806e450d0c0
P3: 0
P4: fffff806ec582b7a
P5: 2
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\032520-9515-01.dmp
\\?\C:\WINDOWS\TEMP\WER-40734-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER30A0.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER30B1.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER30CF.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER30D0.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_50_61253c9be9179e1499ecc3c3295b2399d9fe93f9_00000000_cab_d579db39-0b4d-40ec-889c-8f164622aa83

Analysis symbol: 
Rechecking for solution: 0
Report Id: 71581149-4861-45fa-8d77-243782ab3e8e
Report Status: 4
Hashed bucket: 
Cab Guid: 0
5/1/2020 6:33 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: a
P2: 18
P3: 2
P4: 0
P5: fffff8071451d2dd
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\050120-27734-01.dmp
\\?\C:\WINDOWS\TEMP\WER-32140-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F9D.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FBD.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FDC.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FEC.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_a_942d5e92b41b197fd22540a9fb174925b250_00000000_cab_2ab7b400-260a-4806-b943-36039a7d1e16

Analysis symbol: 
Rechecking for solution: 0
Report Id: e0f2adfc-5fdc-4d59-98ba-6f3d74091788
Report Status: 4
Hashed bucket: 
Cab Guid: 0
5/14/2020 1:01 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: a
P2: 400a11
P3: 2
P4: 1
P5: fffff80562c57488
P6: 10_0_18363
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051320-27437-01.dmp
\\?\C:\WINDOWS\TEMP\WER-32343-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER91B0.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER91D1.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER91EF.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER91F0.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_a_77697c1bcb3f4d54e21d86edeb962ceb0d4e3f1_00000000_cab_1def26bc-4b45-4880-8299-a43ee188827f

Analysis symbol: 
Rechecking for solution: 0
Report Id: a362737f-77f5-43a4-9b2f-69955220a76d
Report Status: 4
Hashed bucket: 
Cab Guid: 0
10/29/2019 9:50 PM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: a
P2: ffffebffc87fc878
P3: 2
P4: 0
P5: fffff80333679a64
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\102919-12453-01.dmp
\\?\C:\WINDOWS\TEMP\WER-19890-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61D8.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61E9.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61E8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6208.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_a_a3e90ce906a4cedace2dc37dd7a2c4625b882b_00000000_cab_d661f1c4-0930-4a8a-8de8-949abc573778

Analysis symbol: 
Rechecking for solution: 0
Report Id: 2c664b66-0102-4742-9a3e-d44cc542b0b6
Report Status: 4
Hashed bucket: 
Cab Guid: 0
3/25/2020 8:59 PM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: be
P2: fffff80b6e5fd268
P3: 890000041a022121
P4: ffff820a82c7e940
P5: a
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\032520-11718-01.dmp
\\?\C:\WINDOWS\TEMP\WER-43859-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER39CA.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER39CB.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER39D9.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER39DA.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_be_488acde9a6c4a329b6915b1ee7678a877d9b1e_00000000_cab_d24f2594-1c0d-490d-92e6-caabc43f90bb

Analysis symbol: 
Rechecking for solution: 0
Report Id: 6513ec0f-b29d-47db-ad33-c99f21b2a88f
Report Status: 4
Hashed bucket: 
Cab Guid: 0
5/13/2020 2:00 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: c000021a
P2: ffffe70961aea1f0
P3: ffffffffc0000005
P4: 7ffebda92c7d
P5: 84d817e080
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051220-26234-01.dmp
\\?\C:\WINDOWS\TEMP\WER-30046-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8721.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8751.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER876F.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8780.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c000021a_fa942999edf14a0158b8e443fbba4f8b62946_00000000_cab_e61362c5-ed10-4f11-aebb-fe70bb853b5d

Analysis symbol: 
Rechecking for solution: 0
Report Id: 1f007507-ae98-4284-b526-44d51e29633f
Report Status: 4
Hashed bucket: 
Cab Guid: 0
5/1/2020 3:36 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: d1
P2: 60
P3: 2
P4: 0
P5: fffff805864b5bfd
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\043020-11843-01.dmp
\\?\C:\WINDOWS\TEMP\WER-16078-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER512D.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER514D.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER515C.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER516C.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_d1_7c88c93b8839d4283e2ac5e8c6191d68398f477_00000000_cab_fb055fd0-d0b9-491f-bc68-cd8a4bf6a5fc

Analysis symbol: 
Rechecking for solution: 0
Report Id: 271c47c9-3e6d-489b-a548-80b30ecae1e5
Report Status: 4
Hashed bucket: 
Cab Guid: 0
5/14/2020 1:05 AM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: ef
P2: ffffa90f66e21140
P3: 0
P4: 0
P5: 0
P6: 10_0_18363
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051320-26953-01.dmp
\\?\C:\WINDOWS\TEMP\WER-31625-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D8A.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8DBA.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8DD8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8DE9.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_ef_1afd699ee0e179986317c790b8f9933c3ef7a6_00000000_cab_7223f538-5173-4c9f-bb93-7f6f91c8de2d

Analysis symbol: 
Rechecking for solution: 0
Report Id: a96461ce-b8b0-42aa-8701-c008fb85dbd6
Report Status: 4
Hashed bucket: 
Cab Guid: 0
10/29/2019 9:53 PM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 4f5f2329-c9ae-4086-8c16-160d9434aa02

Problem signature:
P1: a
P2: ffffebffc87fc878
P3: 2
P4: 0
P5: fffff80333679a64
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\102919-12453-01.dmp
\\?\C:\WINDOWS\TEMP\WER-19890-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61D8.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61E9.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61E8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6208.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_a_a3e90ce906a4cedace2dc37dd7a2c4625b882b_00000000_cab_d661f1c4-0930-4a8a-8de8-949abc573778

Analysis symbol: 
Rechecking for solution: 0
Report Id: 2c664b66-0102-4742-9a3e-d44cc542b0b6
Report Status: 4
Hashed bucket: 
Cab Guid: 0
10/29/2019 9:50 PM	Windows Error Reporting	Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 4f5f2329-c9ae-4086-8c16-160d9434aa02

Problem signature:
P1: a
P2: ffffebffc87fc878
P3: 2
P4: 0
P5: fffff80333679a64
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\102919-12453-01.dmp
\\?\C:\WINDOWS\TEMP\WER-19890-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61D8.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61E9.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61E8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6208.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_a_a3e90ce906a4cedace2dc37dd7a2c4625b882b_00000000_cab_d661f1c4-0930-4a8a-8de8-949abc573778

Analysis symbol: 
Rechecking for solution: 0
Report Id: 2c664b66-0102-4742-9a3e-d44cc542b0b6
Report Status: 4
Hashed bucket: 
Cab Guid: 0

Code:

5/1/2020 1:42 AM	Windows Error Reporting	Fault bucket 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiInsertTimerTable, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 4d548f85-e86b-4556-88f3-072062a4f40c

Problem signature:
P1: 139
P2: 3
P3: ffffef8d3b1db7b0
P4: ffffef8d3b1db708
P5: 0
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\043020-21812-01.dmp
\\?\C:\WINDOWS\TEMP\WER-26625-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER79C5.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER79D6.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER79D5.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER79E6.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_139_86277d29d794c9b7ba243242757921794841d_00000000_cab_fafc0ff6-5e9c-4830-85d7-6c0cb69e7073

Analysis symbol: 
Rechecking for solution: 0
Report Id: e0f42115-fc5e-4897-9a75-b728493cbbcc
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
5/14/2020 12:05 AM	Windows Error Reporting	Fault bucket 0x18_CORRUPT_REF_COUNT_nt!ObCloseHandleTableEntry, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: b1f54b8a-fbe2-4591-bfc9-a72df90a57a2

Problem signature:
P1: 18
P2: 0
P3: ffff9c8b0f836370
P4: 2
P5: fffffffffffffff8
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051320-27937-01.dmp
\\?\C:\WINDOWS\TEMP\WER-33031-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9356.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9386.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9395.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER93A5.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_18_318d4fb38a8c032f63199325b82f7373414ea84_00000000_cab_facb9f1a-433b-4cd3-a502-31a8e6c593c9

Analysis symbol: 
Rechecking for solution: 0
Report Id: b404c07d-f667-49c3-8449-7d773e9f9f00
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
5/12/2020 11:28 PM	Windows Error Reporting	Fault bucket 0x3B_c000001d_nt!SepAccessCheckAndAuditAlarmWithAdminlessChecks, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: aa16d6ea-382b-422c-b0ff-a81fb383f348

Problem signature:
P1: 3b
P2: c000001d
P3: fffff807418ee200
P4: ffffc78349aedcb0
P5: 0
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051220-10093-01.dmp
\\?\C:\WINDOWS\TEMP\WER-21593-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BBA.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BCA.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BE9.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C47.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_3b_576bc767e51ebcf27ff947d9a2ef5e4cab153258_00000000_cab_5bb80dc1-e2ae-4cf4-b5ff-f70a05524264

Analysis symbol: 
Rechecking for solution: 0
Report Id: 7737b975-53b6-4282-af75-417d93ec713f
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
3/25/2020 9:03 PM	Windows Error Reporting	Fault bucket 0xBE_usbaudio!USBCaptureRequeueWorker, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: c5b165af-38c0-485e-8518-715ac7cbe311

Problem signature:
P1: be
P2: fffff80b6e5fd268
P3: 890000041a022121
P4: ffff820a82c7e940
P5: a
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\032520-11718-01.dmp
\\?\C:\WINDOWS\TEMP\WER-43859-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER39CA.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER39CB.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER39D9.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER39DA.tmp.txt
\\?\C:\Windows\Temp\WER8EA0.tmp.WERDataCollectionStatus.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_be_488acde9a6c4a329b6915b1ee7678a877d9b1e_00000000_cab_d24f2594-1c0d-490d-92e6-caabc43f90bb

Analysis symbol: 
Rechecking for solution: 0
Report Id: 6513ec0f-b29d-47db-ad33-c99f21b2a88f
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
5/13/2020 2:00 AM	Windows Error Reporting	Fault bucket 0xc000021a_nt!PopTransitionSystemPowerStateEx, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 12ddc1ea-37d8-4986-a477-02f10feb0ac8

Problem signature:
P1: c000021a
P2: ffffe70961aea1f0
P3: ffffffffc0000005
P4: 7ffebda92c7d
P5: 84d817e080
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051220-26234-01.dmp
\\?\C:\WINDOWS\TEMP\WER-30046-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8721.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8751.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER876F.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8780.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_c000021a_fa942999edf14a0158b8e443fbba4f8b62946_00000000_cab_e61362c5-ed10-4f11-aebb-fe70bb853b5d

Analysis symbol: 
Rechecking for solution: 0
Report Id: 1f007507-ae98-4284-b526-44d51e29633f
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
5/14/2020 1:05 AM	Windows Error Reporting	Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_c0000005_ntdll.dll!memcpy_nt!PspCatchCriticalBreak, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: be595b78-fb74-4e01-8fe3-5efc1eaa6346

Problem signature:
P1: ef
P2: ffffa90f66e21140
P3: 0
P4: 0
P5: 0
P6: 10_0_18363
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051320-26953-01.dmp
\\?\C:\WINDOWS\TEMP\WER-31625-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D8A.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8DBA.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8DD8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8DE9.tmp.txt
\\?\C:\Windows\Temp\WERC9D8.tmp.WERDataCollectionStatus.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_1afd699ee0e179986317c790b8f9933c3ef7a6_00000000_cab_7223f538-5173-4c9f-bb93-7f6f91c8de2d

Analysis symbol: 
Rechecking for solution: 0
Report Id: a96461ce-b8b0-42aa-8701-c008fb85dbd6
Report Status: 2147483648
Hashed bucket: 
Cab Guid: 0

Code:

5/1/2020 6:33 AM	Windows Error Reporting	Fault bucket AV_nt!ExFreePool, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 56cf533f-435d-420f-ac68-d0a1d2b09d5f

Problem signature:
P1: a
P2: 18
P3: 2
P4: 0
P5: fffff8071451d2dd
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\050120-27734-01.dmp
\\?\C:\WINDOWS\TEMP\WER-32140-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F9D.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FBD.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FDC.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FEC.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_a_942d5e92b41b197fd22540a9fb174925b250_00000000_cab_2ab7b400-260a-4806-b943-36039a7d1e16

Analysis symbol: 
Rechecking for solution: 0
Report Id: e0f2adfc-5fdc-4d59-98ba-6f3d74091788
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
10/30/2019 12:19 AM	Windows Error Reporting	Fault bucket AV_nt!RtlImageNtHeaderEx, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 4f5f2329-c9ae-4086-8c16-160d9434aa02

Problem signature:
P1: a
P2: ffffebffc87fc878
P3: 2
P4: 0
P5: fffff80333679a64
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\102919-12453-01.dmp
\\?\C:\WINDOWS\TEMP\WER-19890-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61D8.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61E9.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER61E8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6208.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_a_a3e90ce906a4cedace2dc37dd7a2c4625b882b_00000000_cab_d661f1c4-0930-4a8a-8de8-949abc573778

Analysis symbol: 
Rechecking for solution: 0
Report Id: 2c664b66-0102-4742-9a3e-d44cc542b0b6
Report Status: 268435460
Hashed bucket: 
Cab Guid: 0
3/25/2020 7:54 PM	Windows Error Reporting	Fault bucket AV_R_INVALID_dxgkrnl!DxgkCheckMonitorPowerState, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 5786a4c7-ff26-4ca1-a1ba-8cf9dfe4087c

Problem signature:
P1: 50
P2: fffff806e450d0c0
P3: 0
P4: fffff806ec582b7a
P5: 2
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\032520-9515-01.dmp
\\?\C:\WINDOWS\TEMP\WER-40734-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER30A0.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER30B1.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER30CF.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER30D0.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_50_61253c9be9179e1499ecc3c3295b2399d9fe93f9_00000000_cab_d579db39-0b4d-40ec-889c-8f164622aa83

Analysis symbol: 
Rechecking for solution: 0
Report Id: 71581149-4861-45fa-8d77-243782ab3e8e
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
5/1/2020 3:36 AM	Windows Error Reporting	Fault bucket AV_tcpip!IpNlpFastContinueSendDatagrams, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 4db38864-8298-4a11-bb65-57c435a17c9c

Problem signature:
P1: d1
P2: 60
P3: 2
P4: 0
P5: fffff805864b5bfd
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\043020-11843-01.dmp
\\?\C:\WINDOWS\TEMP\WER-16078-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER512D.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER514D.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER515C.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER516C.tmp.txt
\\?\C:\Windows\Temp\WER8C52.tmp.WERDataCollectionStatus.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_d1_7c88c93b8839d4283e2ac5e8c6191d68398f477_00000000_cab_fb055fd0-d0b9-491f-bc68-cd8a4bf6a5fc

Analysis symbol: 
Rechecking for solution: 0
Report Id: 271c47c9-3e6d-489b-a548-80b30ecae1e5
Report Status: 2147483648
Hashed bucket: 
Cab Guid: 0
5/14/2020 1:02 AM	Windows Error Reporting	Fault bucket IP_MISALIGNED, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: e3a9dc3f-6e74-466d-bf26-5b0c132e16f9

Problem signature:
P1: a
P2: 400a11
P3: 2
P4: 1
P5: fffff80562c57488
P6: 10_0_18363
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051320-27437-01.dmp
\\?\C:\WINDOWS\TEMP\WER-32343-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER91B0.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER91D1.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER91EF.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER91F0.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_a_77697c1bcb3f4d54e21d86edeb962ceb0d4e3f1_00000000_cab_1def26bc-4b45-4880-8299-a43ee188827f

Analysis symbol: 
Rechecking for solution: 0
Report Id: a362737f-77f5-43a4-9b2f-69955220a76d
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
3/25/2020 8:59 PM	Windows Error Reporting	Fault bucket LKD_0x1A1_WIN32K_CALLOUT_WATCHDOG_win32kbase!UserPowerInfoCallout, type 0
Event Name: LiveKernelEvent
Response: Not available
Cab Id: 05639d24-b735-4152-8a77-bf658974b3aa

Problem signature:
P1: 1a1
P2: ffff800e94b5f040
P3: 0
P4: 0
P5: 0
P6: 10_0_18362
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\LiveKernelReports\PoW32kWatchdog\PoW32kWatchdog-20200325-1554.dmp
\\?\C:\WINDOWS\TEMP\WER-43859-0.sysdata.xml
\\?\C:\WINDOWS\LiveKernelReports\PoW32kWatchdog-20200325-1554.dmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER396A.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER397B.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3999.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER399A.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1a1_ec82a907618386f24303af7beb0d35b2ab1a37_00000000_cab_0c122485-4f5d-4ac5-a182-9f53f5504339

Analysis symbol: 
Rechecking for solution: 0
Report Id: 0c122485-4f5d-4ac5-a182-9f53f5504339
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0

Here's the requested info. He's going to run Memtest overnight tonight, figured I would post everything else today rather than waiting just for that.

I'm not really sure what you're asking for with CCleaner, do you want me to check a setting and click Analyze? Step 15 in your post doesn't actually say what to check or click.

PoW32kWatchdog-20200422-2006.dmp

SeaTools reported a pass for all drives.

PowerShell output:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Try the new cross-platform PowerShell Installing PowerShell - PowerShell | Microsoft Docs

PS C:\WINDOWS\system32> sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.
PS C:\WINDOWS\system32> dism /online /cleanup-image /scanhealth

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Image Version: 10.0.18363.836

[==========================100.0%==========================] No component store corruption detected.
The operation completed successfully.
PS C:\WINDOWS\system32> dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Image Version: 10.0.18363.836

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.
PS C:\WINDOWS\system32> sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.
PS C:\WINDOWS\system32> chkdsk /scan
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
419840 file records processed.
File verification completed.
19391 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
65191 reparse records processed.
583226 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
65191 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
81694 data files processed.
CHKDSK is verifying Usn Journal...
40260608 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

116590591 KB total disk space.
100176040 KB in 266192 files.
224372 KB in 81695 indexes.
0 KB in bad sectors.
543763 KB in use by the system.
65536 KB occupied by the log file.
15646416 KB available on disk.

4096 bytes in each allocation unit.
29147647 total allocation units on disk.
3911604 allocation units available on disk.
PS C:\WINDOWS\system32> wmic recoveros set autoreboot = false
Updating property(s) of '\\DESKTOP-4IU087C\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Education|C:\\WINDOWS|\\Device\\Harddisk0\\Partition4"'
Property(s) update successful.
PS C:\WINDOWS\system32> wmic recoveros set DebugInfoType = 7
Updating property(s) of '\\DESKTOP-4IU087C\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Education|C:\\WINDOWS|\\Device\\Harddisk0\\Partition4"'
Property(s) update successful.
PS C:\WINDOWS\system32> wmic recoveros get autoreboot
AutoReboot
FALSE

PS C:\WINDOWS\system32> wmic recoveros get DebugInfoType
DebugInfoType
7

PS C:\WINDOWS\system32> bcdedit /enum {badmemory}
Invalid command line switch: /encodedCommand
Run "bcdedit /?" for command line assistance.
The parameter is incorrect.
PS C:\WINDOWS\system32>

For Ccleaner the end user can decide what to clean and not clean.
During the troubleshooting there are files needed that can be cleaned when Ccleaner is used.
Open Ccleaner > click windows tab or custom clean > scroll down to system and advanced > post an image into the thread

By posting the settings they can be viewed and modified as needed.

For all steps and tests > post images of the results into the thread:


Take Screenshot in Windows 10
https://support.microsoft.com/en-gb/...re-screenshots
How to Upload and Post Screenshots and Files at Ten Forums

For startup and recovery system failure:
a) uncheck automatically restart if not already unchecked
b) reboot to maintain settings

For Virtual Memory:
a) check the box to Automatically manage paging file size for all drives
b) reboot to maintain settings

For HD Tune:
post images of benchmark results

For Sea Tools
post images of long generic test results

Vaindil said:

My brother's computer keeps getting BSODs, and he's having other issues where programs are randomly crashing as well.

Did this start happening after installing Valorant? Their anti-cheat system, Vanguard, always runs in the background and hooks into the kernel. Quite a few people have reported that this has caused problems with their system, so it is probably worth seeing if uninstalling it completely (and then rebooting) changes anything.

Also your headset's user-mode driver seems to be encountering problems, see if there's an update or just try using it without the driver.

Spectrum said:

Did this start happening after installing Valorant? Their anti-cheat system, Vanguard, always runs in the background and hooks into the kernel. Quite a few people have reported that this has caused problems with their system, so it is probably worth seeing if uninstalling it completely (and then rebooting) changes anything.
Also your headset's user-mode driver seems to be encountering problems, see if there's an update or just try using it without the driver.

I've uninstalled Vanguard from his computer to see if that fixes it, I'll know for sure tomorrow.

Are you able to see which headset specifically is having issues? He only has one (HyperX Cloud II), but he recently got rid of an older one that was having issues. The HyperX headset doesn't have a driver installed by him, it's just plug 'n play via USB. I also don't see any other drivers for a headset in device manager.

- - - Updated - - -

Looks like my brother was technically OCing his RAM from 2133 to 2666 and his motherboard couldn't handle it (Asus Prime B350-Plus). The motherboard apparently has instability at any RAM OC at all, so he'll just have to keep his RAM at 2133. (This also ensures that I'll probably not buy an Asus motherboard.)

Thanks for your help, I really appreciate it!

That's good news that there is computer stability without the RAM overclock.

You're welcome.

Consider making free backup images:

(Acronis, Aoemi, EaseUS, Macrium, Paragon, etc.)


Macrium Software | Your Image is Everything
Backup and Restore with Macrium Reflect